CVE-2026-87491
Description
CVE-2026-87491 is a high-severity RCE vulnerability in Google Chrome's V8 engine. Learn how to protect your systems from active exploitation.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| chrome | * | 153.0.8010.36 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately update Google Chrome and Chromium-based browsers to version 153.0.8010.36 or later. Google has released stable channel updates for Windows, Mac, and Linux to address this out-of-bounds write flaw in the V8 engine.
Update affected systems
Ensure all enterprise workstations and servers running Chromium-based applications are updated to versions higher than 153.0.8010.36. Use endpoint management tools to verify that no legacy versions remain in the environment.
Restrict access
Implement web filtering and DNS security to block access to untrusted or high-risk websites. Since the attack vector requires user interaction with a malicious HTML page, reducing exposure to suspicious web zones mitigates the risk of exploitation.
Monitor for exploitation
Utilize EDR and SIEM tools to monitor for unusual browser behavior, such as unexpected child processes spawning from chrome.exe or frequent crashes in the V8 component, which may indicate an attempted out-of-bounds write.
Detection Guidance
"Detection should focus on identifying crashes in the chrome.exe process or the V8 JavaScript engine. Monitor for memory corruption indicators and unusual shellcode-like patterns in web traffic. Security teams should use EDR signatures to detect heap-based buffer overflows or out-of-bounds write attempts (CWE-787) and watch for unauthorized outbound network connections originating from browser processes following a crash."